HP.Firmware

1.4.1.0

HP.Firmware.SecurePlatform.psm1

# Copyright (C)2018 HP Inc
# All Rights Reserved.
#
# NOTICE: All information contained herein is, and remains the property of HP Inc.
#
# The intellectual and technical concepts contained herein are proprietary to HP Inc
# and may be covered by U.S. and Foreign Patents, patents in process, and are protected by
# trade secret or copyright law. Dissemination of this information or reproduction of this material
# is strictly forbidden unless prior written permission is obtained from HP Inc.

Set-StrictMode -Version 3.0
$ErrorActionPreference = "Stop"
#requires -Modules "HP.Private"


<#
.SYNOPSIS
    Get the HP Secure Platform state
 
.DESCRIPTION
    This function returns the state of the HP Secure Platform.
 
.NOTES
    - Supported on Windows 10.
  - Requires HP BIOS with secure platform support.
     - This command requires elevated privileges.
#>
function Get-HPSecurePlatformState {
  [CmdletBinding(HelpUri = "https://developers.hp.com/hp-client-management/doc/New%E2%80%90HPSecurePlatformState")]
  param()
  $mi_result = 0
  $data = New-Object -TypeName provisioning_data_t
  $c = '[DfmNativeSecurePlatform]::get_secureplatform_provisioning' + (Test-OSBitness) + '([ref]$data,[ref]$mi_result);'
  $result = Invoke-Expression -Command $c
  Test-HPPrivateCustomResult -result $result -mi_result $mi_result -Category 0x04

  $kek_mod = $data.kek_mod
  [array]::Reverse($kek_mod)

  $sk_mod = $data.sk_mod
  [array]::Reverse($sk_mod)

  $obj = [ordered]@{
    State             = $data.State
    Version           = "$($data.subsystem_version[0]).$($data.subsystem_version[1])"
    Nonce             = $($data.arp_counter)
    FeaturesInUse     = $data.features_in_use
    EndorsementKeyMod = $kek_mod
    SigningKeyMod     = $sk_mod
  }
  return New-Object -TypeName PSCustomObject -Property $obj
}


<#
.SYNOPSIS
    Create an HP Secure Platform payload to provision a _Key Endorsement_ key.
 
.DESCRIPTION
    The purpose of the endorsement key is to protect the signing key against unauthorized changes.
    Only holders of the key endorsement private key may change the signing key.
 
  On return, the function writes the created payload to the pipeline, or to the file specified in the OutputFile parameter.
  This payload can then be passed to the [Set-HPSecurePlatformPayload](Set-HPSecurePlatformPayload) function.
 
<div style="background-color: #ee8; padding:10px;">
 
<h4>Security note</h4>
Payloads should only be created on secure servers. Once created, the payload may be transferred to a client and applied via the <b>Set-HPSecurePlatformPayload</b> . Creating the payload and passing it to the <b>Set-HPSecurePlatformPayload</b> function via the pipeline is not a recommended production pattern.
 
</div>
 
.PARAMETER EndorsementKeyFile
    The _Key Endorsement_ key certificate, as a PFX (PKCS #12) file.
 
.PARAMETER EndorsementKeyFilePassword
    The password for the _Endorsement Key_ PFX file. If no password was used when the PFX was created (which is not recommended), this parameter may be omitted.
 
.PARAMETER EndorsementKeyCertificate
    This parameter is currently reserved for internal use only.
 
.PARAMETER EndorsementKeyCertificatePassword
    This parameter is currently reserved for internal use only.
 
.PARAMETER BIOSPassword
  The active BIOS Setup password, if any. Note that the password will be in the clear in the generated payload.
   
.PARAMETER OutputFile
     Write the resulting output to the specified file, instead of writing it to the pipeline.
 
 
.NOTES
    The Key Endorsement private key must never leave a secure server. The payload must be created on a secure server, then may be transferred to a client.
 
    - Supported on Windows 10.
    - Requires HP BIOS with secure platform support.
 
.EXAMPLE
   $payload = New-HPSecurePlatformEndorsementKeyProvisioningPayload -EndorsementKeyFile "$path\endorsement_key.pfx"
   ...
   $payload | Set-HPSecurePlatformPayload
     
#>
function New-HPSecurePlatformEndorsementKeyProvisioningPayload {
  [CmdletBinding(DefaultParameterSetName = "EK_FromFile", HelpUri = "https://developers.hp.com/hp-client-management/doc/New%E2%80%90HPSecurePlatformEndorsementKeyProvisioningPayload")]
  param(
    [Parameter(ParameterSetName = "EK_FromFile", Mandatory = $true, Position = 0)]
    [System.IO.FileInfo]$EndorsementKeyFile,

    [Parameter(ParameterSetName = "EK_FromFile", Mandatory = $false, Position = 1)]
    [string]$EndorsementKeyPassword,

    [Parameter(ParameterSetName = "EK_FromBytes", Mandatory = $true, Position = 0)]
    [System.Security.Cryptography.X509Certificates.X509Certificate2]$EndorsementKeyCertificate,

    [Parameter(ParameterSetName = "EK_FromFile", Mandatory = $false, Position = 2)]
    [Parameter(ParameterSetName = "EK_FromBytes", Mandatory = $false, Position = 2)]
    [string]$BIOSPassword,

    [Parameter(ParameterSetName = "EK_FromFile", Mandatory = $false, Position = 3)]
    [Parameter(ParameterSetName = "EK_FromBytes", Mandatory = $false, Position = 3)]
    [System.IO.FileInfo]$OutputFile
  )

  $crt = (Get-HPPrivateX509CertCoalesce -File $EndorsementKeyFile -cert $EndorsementKeyCertificate -password $EndorsementKeyPassword -Verbose:$VerbosePreference).Certificate
  Write-Verbose "Creating EK provisioning payload"

  if ($BIOSPassword) {
    $passwordLength = $BIOSPassword.Length
  }
  else {
    $passwordLength = 0
  }

  $opaque = New-Object opaque4096_t
  $opaqueLength = 4096
  $mi_result = 0
  $cmd = '[DfmNativeSecurePlatform]::get_ek_provisioning_data' + (Test-OSBitness) + '($crt,$($crt.Count),$BIOSPassword, $passwordLength, [ref]$opaque, [ref]$opaqueLength, [ref]$mi_result);'
  $result = Invoke-Expression -Command $cmd
  Test-HPPrivateCustomResult -result $result -mi_result $mi_result -Category 0x04

  $output = New-Object -TypeName PortableFileFormat
  $output.data = $opaque.raw[0..($opaqueLength - 1)]
  $output.purpose = "hp:provision:endorsementkey"
  $output.timestamp = Get-Date

  if ($OutputFile) {
    Write-Verbose 'Will output to file $OutputFile'
    $f = $ExecutionContext.SessionState.Path.GetUnresolvedProviderPathFromPSPath($OutputFile)
    $output | ConvertTo-Json -Compress | Out-File $f -Encoding utf8
  }
  else {
    $output | ConvertTo-Json -Compress
  }
}


<#
.SYNOPSIS
    Create an HP Secure Platform payload to provision a _Signing Key_ key.
 
.DESCRIPTION
  The purpose of the signing key is to sign commands for the secure platform. The Signing key is protected
  by the endorsement key, therefore the endorsement key private key must be available when provisioning or
  changing the signing key.
 
  On return, the function writes the created payload to the pipeline, or to the file specified in the OutputFile parameter.
  This payload can then be passed to the [Set-HPSecurePlatformPayload](Set-HPSecurePlatformPayload) function.
 
<div style="background-color: #ee8; padding:10px;">
 
<h4>Security note</h4>
Payloads should only be created on secure servers. Once created, the payload may be transferred to a client and applied via the <b>Set-HPSecurePlatformPayload</b> . Creating the payload and passing it to the <b>Set-HPSecurePlatformPayload</b> function via the pipeline is not a recommended production pattern.
 
</div>
 
.PARAMETER EndorsementKeyFile
    The _Key Endorsement_ key certificate, as a PFX (PKCS #12) file. The endorsement key protects the signing key.
 
.PARAMETER EndorsementKeyPassword
    The password for the _Endorsement Key_ PFX file. If no password was used when the PFX was created (which is not recommended), this parameter may be omitted.
 
.PARAMETER EndorsementKeyCertificate
    The endorsement key certificate, as an X509Certificate object.
  
.PARAMETER SigningKeyFile
    The signing key certificate, as a PFX (PKCS #12) file. The endorsement key protects the signing key.
 
.PARAMETER SigningKeyCertificate
    The signing key certificate, as an X509Certificate object.
 
.PARAMETER SigningKeyCertificate
    This parameter is currently reserved for internal use only.
 
.PARAMETER SigningKeyPassword
    The signing key certificate, as an X509Certificate object.
   
.PARAMETER Nonce
     The operation nonce. In order to prevent replay attacks, the secure platform subsystem will only accept commands with a
     nonce greater or equal to the last nonce sent.
 
     If not specified, the nonce is inferred from the current local time. This works okay in most cases, however this approach has a resolution of seconds,
     so when doing high volume or parallel operations, it is possible to infer the same counter for two or more commands. In those cases, the caller
     should use its own nonce derivation and provide it through this parameter.
 
.PARAMETER OutputFile
     Write the resulting output to the specified file, instead of writing it to the pipeline.
 
   
.NOTES
    - Supported on Windows 10.
  - Requires HP BIOS with secure platform support.
 
.EXAMPLE
  $payload = New-HPSecurePlatformSigningKeyProvisioningPayload -EndorsementKeyFile "$path\endorsement_key.pfx" `
               -SigningKeyFile "$path\signing_key.pfx"
  ...
  $payload | Set-HPSecurePlatformPayload
 
#>
function New-HPSecurePlatformSigningKeyProvisioningPayload {
  [CmdletBinding(DefaultParameterSetName = "EF_SF", HelpUri = "https://developers.hp.com/hp-client-management/doc/New%E2%80%90HPSecurePlatformSigningKeyProvisioningPayload")]
  param(
    [Parameter(ParameterSetName = "EF_SF", Mandatory = $true, Position = 0)]
    [Parameter(ParameterSetName = "EF_SB", Mandatory = $true, Position = 0)]
    [System.IO.FileInfo]$EndorsementKeyFile,

    [Parameter(ParameterSetName = "EF_SF", Mandatory = $false, Position = 1)]
    [Parameter(ParameterSetName = "EF_SB", Mandatory = $false, Position = 1)]
    [string]$EndorsementKeyPassword,

    [Parameter(ParameterSetName = "EF_SF", Mandatory = $false, Position = 2)]
    [Parameter(ParameterSetName = "EB_SF", Mandatory = $false, Position = 2)]
    [System.IO.FileInfo]$SigningKeyFile,

    [Parameter(ParameterSetName = "EF_SF", Mandatory = $false, Position = 3)]
    [Parameter(ParameterSetName = "EB_SF", Mandatory = $false, Position = 3)]
    [string]$SigningKeyPassword,

    [Parameter(ParameterSetName = "EB_SF", Mandatory = $true, Position = 0)]
    [Parameter(ParameterSetName = "EB_SB", Mandatory = $true, Position = 0)]
    [System.Security.Cryptography.X509Certificates.X509Certificate2]$EndorsementKeyCertificate,

    [Parameter(ValueFromPipeline=$true, ParameterSetName = "EB_SB", Mandatory = $false, Position = 2)]
    [Parameter(ValueFromPipeline=$true, ParameterSetName = "EF_SB", Mandatory = $false, Position = 2)]
    [System.Security.Cryptography.X509Certificates.X509Certificate2]$SigningKeyCertificate,

    [Parameter(ParameterSetName = "EF_SF", Mandatory = $false, Position = 4)]
    [Parameter(ParameterSetName = "EB_SF", Mandatory = $false, Position = 4)]
    [Parameter(ParameterSetName = "EF_SB", Mandatory = $false, Position = 4)]
    [Parameter(ParameterSetName = "EB_SB", Mandatory = $false, Position = 4)]
    [uint32]$Nonce = [math]::Floor([decimal](Get-Date (Get-Date).ToUniversalTime() -UFormat "%s")),

    [Parameter(ParameterSetName = "EF_SF", Mandatory = $false, Position = 5)]
    [Parameter(ParameterSetName = "EB_SF", Mandatory = $false, Position = 5)]
    [Parameter(ParameterSetName = "EF_SB", Mandatory = $false, Position = 5)]
    [Parameter(ParameterSetName = "EB_SB", Mandatory = $false, Position = 5)]
    [System.IO.FileInfo]$OutputFile
  )

  $ek = Get-HPPrivateX509CertCoalesce -File $EndorsementKeyFile -password $EndorsementKeyPassword -cert $EndorsementKeyCertificate -Verbose:$VerbosePreference

  $sk = $null

  if ($SigningKeyFile -or $SigningKeyCertificate) {
    $sk = Get-HPPrivateX509CertCoalesce -File $SigningKeyFile -password $SigningKeyPassword -cert $SigningKeyCertificate -Verbose:$VerbosePreference
  }

  Write-Verbose "Creating SK provisioning payload"

  $payload = New-Object sk_provisioning_t
  $sub = New-Object sk_provisioning_payload_t

  $sub.Counter = $nonce
  if ($sk) {
    $sub.mod = $Sk.Modulus
  }
  else {
    Write-Verbose "Assuming deprovisioning due to missing signing key update"
    $sub.mod = New-Object byte[] 256 
  }
  $payload.data = $sub
  Write-Verbose "Using counter value of $($sub.Counter)"
  $out = Convert-HPPrivateObjectToBytes -obj $sub -Verbose:$VerbosePreference
  $payload.sig = Invoke-HPPrivateSignData -data $out[0] -Certificate $ek.Full -Password $SigningKeyPassword  -Verbose:$VerbosePreference


  Write-Verbose "Serializing payload"
  $out = Convert-HPPrivateObjectToBytes -obj $payload -Verbose:$VerbosePreference

  $output = New-Object -TypeName PortableFileFormat
  $output.data = ($out[0])[0..($out[1] - 1)];
  $output.purpose = "hp:provision:signingkey"
  $output.timestamp = Get-Date

  if ($OutputFile) {
    Write-Verbose 'Will output to file $OutputFile'
    $f = $ExecutionContext.SessionState.Path.GetUnresolvedProviderPathFromPSPath($OutputFile)
    $output | ConvertTo-Json -Compress | Out-File -FilePath $f -Encoding utf8
  }
  else {
    $output | ConvertTo-Json -Compress
  }
}



<#
.SYNOPSIS
    Create a deprovisioning payload
 
.DESCRIPTION
    This function creates a payload to deprovision the HP Secure Platform. The caller must have access to the Endorsement Key private key in order
  to create this payload.
   
  On return, the function writes the created payload to the pipeline, or to the file specified in the OutputFile parameter.
  This payload can then be passed to the [Set-HPSecurePlatformPayload](Set-HPSecurePlatformPayload) function.
 
<div style="background-color: #ee8; padding:10px;">
 
<h4>Security note</h4>
Payloads should only be created on secure servers. Once created, the payload may be transferred to a client and applied via the <b>Set-HPSecurePlatformPayload</b> . Creating the payload and passing it to the <b>Set-HPSecurePlatformPayload</b> function via the pipeline is not a recommended production pattern.
 
</div>
 
.PARAMETER EndorsementKeyFile
        The _Key Endorsement_ key certificate, as a PFX (PKCS #12) file.
 
.PARAMETER EndorsementKeyPassword
    The password for the endorsement key certificate file. If no password was used when the PFX was created (which is not recommended), this parameter may be omitted.
 
.PARAMETER EndorsementKeyCertificate
    The endorsement key certificate, as an X509Certificate object.
 
.PARAMETER Nonce
     The operation nonce. In order to prevent replay attacks, the secure platform subsystem will only accept commands with a
     nonce greater or equal to the last nonce sent.
 
     If not specified, the nonce is inferred from the current local time. This works okay in most cases, however this approach has a resolution of seconds,
     so when doing high volume or parallel operations, it is possible to infer the same counter for two or more commands. In those cases, the caller
     should use its own nonce derivation and provide it through this parameter.
 
.PARAMETER OutputFile
     Write the resulting output to the specified file, instead of writing it to the pipeline.
 
.NOTES
    - Supported on Windows 10.
  - Requires HP BIOS with secure platform support.
 
#>
function New-HPSecurePlatformDeprovisioningPayload {
  [CmdletBinding(DefaultParameterSetName = "EF", HelpUri = "https://developers.hp.com/hp-client-management/doc/New%E2%80%90HPSecurePlatformDeprovisioningPayload")]
  param(
    [Parameter(ParameterSetName = "EF", Mandatory = $true, Position = 0)]
    [string]$EndorsementKeyFile,

    [Parameter(ParameterSetName = "EF", Mandatory = $false, Position = 1)]
    [string]$EndorsementKeyPassword,

    [Parameter(ParameterSetName = "EF", Mandatory = $false, Position = 2)]
    [Parameter(ParameterSetName = "EB", Mandatory = $false, Position = 2)]
    [uint32]$nonce = [math]::Floor([decimal](Get-Date (Get-Date).ToUniversalTime() -UFormat "%s")),

    [Parameter(ParameterSetName = "EB", Mandatory = $true, Position = 0)]
    [System.Security.Cryptography.X509Certificates.X509Certificate2]$EndorsementKeyCertificate,

    [Parameter(ParameterSetName = "EB", Mandatory = $false, Position = 4)]
    [Parameter(ParameterSetName = "EF", Mandatory = $false, Position = 4)]
    [System.IO.FileInfo]$OutputFile
  )
  New-HPSecurePlatformSigningKeyProvisioningPayload @PSBoundParameters
}

<#
.SYNOPSIS
    Apply a payload to the HP Secure Platform
 
.DESCRIPTION
  This function applies a properly encoded payload created by one of the New-HPSecurePlatform*, New-HPSureRun*, or New-HPSureRecover* functions
  to the BIOS.
 
  For all purposes, payload objects should be considered to be opaque. Payloads created by means other than the functions mentioned above are not
  supported.
 
<div style="background-color: #ee8; padding:10px;">
 
<h4>Security note</h4>
Payloads should only be created on secure servers. Once created, the payload may be transferred to a client and applied via the <b>Set-HPSecurePlatformPayload</b> . Creating the payload and passing it to the <b>Set-HPSecurePlatformPayload</b> function via the pipeline is not a recommended production pattern.
 
</div>
 
.PARAMETER Payload
        The payload to apply. This parameter can also be specified via the pipeline.
 
.PARAMETER PayloadFile
    The payload file to apply. This file must contain a properly encoded payload.
 
.NOTES
    - Supported on Windows 10.
  - Requires HP BIOS with secure platform support.
    - This command requires elevated privileges.
 
#>
function Set-HPSecurePlatformPayload {

  [CmdletBinding(DefaultParameterSetName = "FB", HelpUri = "https://developers.hp.com/hp-client-management/doc/New%E2%80%90HPSecurePlatformPayload")]
  param(
    [Parameter(ParameterSetName = "FB", ValueFromPipeline=$true, Position = 0, Mandatory = $True)] [string]$Payload,
    [Parameter(ParameterSetName = "FF", ValueFromPipeline=$true, Position = 0, Mandatory = $True)] [System.IO.FileInfo]$PayloadFile
  )

  if ($PSCmdlet.ParameterSetName -eq "FB") {
    Write-Verbose "Setting payload string"
    [PortableFileFormat]$type = ConvertFrom-Json -InputObject $Payload
  }
  else {
    Write-Verbose "Setting from file $PayloadFile"
    [PortableFileFormat]$type = Get-Content -Path $PayloadFile -Encoding UTF8 | ConvertFrom-Json
  }

  $mi_result = 0
  $pbytes = $type.data
  Write-Verbose "Setting payload from document with type $($type.purpose)"

  switch ($type.purpose) {
    "hp:provision:endorsementkey" {
      $cmd = '[DfmNativeSecurePlatform]::set_ek_provisioning' + (Test-OSBitness) + '($pbytes,$pbytes.length, [ref]$mi_result);'
    }
    "hp:provision:signingkey" {
      $cmd = '[DfmNativeSecurePlatform]::set_sk_provisioning' + (Test-OSBitness) + '($pbytes,$pbytes.length, [ref]$mi_result);'
    }
    "hp:surerecover:provision:os_image" {
      $cmd = '[DfmNativeSureRecover]::set_surerecover_osr_provisioning' + (Test-OSBitness) + '($pbytes,$pbytes.length, [ref]$mi_result);'
    }
    "hp:surerecover:provision:recovery_image" {
      $cmd = '[DfmNativeSureRecover]::set_surerecover_re_provisioning' + (Test-OSBitness) + '($pbytes,$pbytes.length, [ref]$mi_result);'
    }
    "hp:surerecover:deprovision" {
      $cmd = '[DfmNativeSureRecover]::set_surerecover_deprovision_opaque' + (Test-OSBitness) + '($pbytes,$pbytes.length, [ref]$mi_result);'
    }
    "hp:surerecover:scheduler" {
      $cmd = '[DfmNativeSureRecover]::set_surerecover_schedule' + (Test-OSBitness) + '($pbytes,$pbytes.length, [ref]$mi_result);'
    }
    "hp:surerecover:configure" {
      $cmd = '[DfmNativeSureRecover]::set_surerecover_configuration' + (Test-OSBitness) + '($pbytes,$pbytes.length, [ref]$mi_result);'
    }
    "hp:surerecover:trigger" {
      $cmd = '[DfmNativeSureRecover]::set_surerecover_trigger' + (Test-OSBitness) + '($pbytes,$pbytes.length, [ref]$mi_result);'
    }
    "hp:surerecover:service_event" {
      $cmd = '[DfmNativeSureRecover]::raise_surerecover_service_event_opaque' + (Test-OSBitness) + '($null,0, [ref]$mi_result);'
    }
    "hp:surerrun:manifest" {
      $mbytes = $type.Meta1
      $cmd = '[DfmNativeSureRun]::set_surererun_manifest' + (Test-OSBitness) + '($pbytes,$pbytes.length, $mbytes, $mbytes.length, [ref]$mi_result);'
    }    
    default {

      throw [System.IO.InvalidDataException]"Document type $($type.purpose) not recognized"
    }
  }
  #$cmd = '[DfmNativeSecurePlatform]::set_sk_provisioning' + (Test-OSBitness) + '($pbytes,$pbytes.length, [ref]$mi_result);'
  $result = Invoke-Expression -Command $cmd
  Test-HPPrivateCustomResult -result $result -mi_result $mi_result -Category 0x04
}

<#
.SYNOPSIS
  #TODO
 
.DESCRIPTION
  #TODO
 
.PARAMETER Payload
    #TODO
 
.PARAMETER PayloadFile
  #TODO
 
.NOTES
    #TODO
 
#>
function ConvertTo-HPSecurePlatformPayload {
  [CmdletBinding(DefaultParameterSetName = "SigningKeyFile", HelpUri = "https://developers.hp.com/hp-client-management/doc/ConvertTo%E2%80%90HPSecurePlatformPayload")]
  param(

    [Parameter(ValueFromPipeline=$true, ParameterSetName = "SigningKeyFile", Mandatory = $true, Position = 0)]
    [Parameter(ValueFromPipeline=$true, ParameterSetName = "SigningKeyCert", Mandatory = $true, Position = 0)]
    [object[]]$InputObject,

    [Parameter(ParameterSetName = "SigningKeyFile", Mandatory = $true, Position = 1)]
    [System.IO.FileInfo]$SigningKeyFile,
  
    [Parameter(ParameterSetName = "SigningKeyFile", Mandatory = $false, Position = 2)]
    [string]$SigningKeyPassword,
  
    [Parameter(ValueFromPipeline=$true, ParameterSetName = "SigningKeyCert", Mandatory = $true, Position = 3)]
    [System.Security.Cryptography.X509Certificates.X509Certificate2]$SigningKeyCertificate,
   
    [Parameter(ParameterSetName = "SigningKeyFile", Mandatory = $false, Position = 4)]
    [Parameter(ParameterSetName = "SigningKeyCert", Mandatory = $false, Position = 4)]
    [uint32]$Nonce = [math]::Floor([decimal](Get-Date (Get-Date).ToUniversalTime() -UFormat "%s")),

    [Parameter(ParameterSetName = "SigningKeyFile", Mandatory = $false, Position = 5)]
    [Parameter(ParameterSetName = "SigningKeyCert", Mandatory = $false, Position = 5)]
    [ValidatePattern('^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$')]
    [string]$TargetUUID = 'ffffffff-ffff-ffff-ffff-ffffffffffff',


    [Parameter(ParameterSetName = "SigningKeyFile", Mandatory = $false, Position = 5)]
    [Parameter(ParameterSetName = "SigningKeyCert", Mandatory = $false, Position = 5)]
    [switch]$SingleUse,


    [Parameter(ParameterSetName = "SigningKeyFile", Mandatory = $false, Position = 6)]
    [Parameter(ParameterSetName = "SigningKeyCert", Mandatory = $false, Position = 6)]
    [System.IO.FileInfo]$OutputFile

  )

  $output = New-Object -TypeName PortableFileFormat
  $settings= New-Object -TypeName SureAdminSettings

  $output.timestamp = Get-Date
  $output.Meta1 = [BitConverter]::GetBytes( $InputObject.Count)
  $output.purpose = "hp:sureadmin:bios_settings"


  foreach ($obj in $InputObject)
  {
    switch($obj.type)
    {
      'hp:sureadmin:bios_setting' {
        $setting = New-Object -TypeName SureAdminSetting
        $setting.Name = $obj.Name
        $setting.Value = $obj.Value
        $setting.Auth = (makeSignature -certFile $SigningKeyFile -certFilePassword $SigningKeyPassword -cert $SigningKeyCertificate  -target $TargetUUID -nonce $Nonce -singleUse $SingleUse.IsPresent -name $obj.Name -value $obj.value)
        $settings.settings.Add($setting)
      }
      default {
        throw [InvalidOperationException]"Unknown object identifier $($obj.type)"
      }
    }
  }
  
  $output.Data = [System.Text.Encoding]::UTF8.GetBytes( ($settings | ConvertTo-Json) )

  if ($OutputFile) {
    Write-Verbose 'Will output to file $OutputFile'
    $f = $ExecutionContext.SessionState.Path.GetUnresolvedProviderPathFromPSPath($OutputFile)
    $output | ConvertTo-Json -Compress | Out-File -FilePath $f -Encoding utf8
  }
  else {
    $output | ConvertTo-Json -Compress
  }

}



function makeSignature
{
  [CmdletBinding()]
  param(
    [string]$name,
    [string]$value,
    [int]$nonce,
    [bool]$singleUse,
    [string]$target,
    [System.Security.Cryptography.X509Certificates.X509Certificate2]$cert,
    [string]$certFile,
    [string]$certFilePassword

  )
  $data = new-object -TypeName SureAdminSignatureBlockHeader

  $data.Version = 1
  $data.NameLength = [System.Text.Encoding]::Unicode.GetByteCount($name)
  $data.ValueLength = [System.Text.Encoding]::Unicode.GetByteCount($value)
  $data.OneTimeUse = [byte]$singleUse
  $data.Reserved = 0
  $data.Nonce = $nonce
  $data.Target = [byte[]] (($target.replace('-','')) -replace '..', '0x$&,' -split ',' -ne '')
    
  
   $head = (Convert-HPPrivateObjectToBytes -obj $data -Verbose:$VerbosePreference)[0]

   $payload  = new-object byte[] ($head.Count + $data.NameLength + $data.ValueLength)
   $namebytes =  [System.Text.Encoding]::Unicode.GetBytes($name)
   $valuebytes =  [System.Text.Encoding]::Unicode.GetBytes($value)
   [System.Array]::Copy($head, 0, $payload, 0, $head.Count)
   [System.Array]::Copy($namebytes, 0, $payload, $head.Count, $namebytes.Count)
   [System.Array]::Copy($valuebytes, 0, $payload, $head.Count + $namebytes.Count, $valuebytes.Count)


   $params = @{ data = $payload }
    if ($certFile)
    {
      $params.add("FileName", $ExecutionContext.SessionState.Path.GetUnresolvedProviderPathFromPSPath($certFile));
      $params.add("Password", $certFilePassword);
    }
    else {
      $params.add("Certificate", $cert)
    }

    [byte[]]$sign = Invoke-HPPrivateSignData @params
    $result  = new-object byte[] ($sign.Length + $payload.Length)    
    [System.Array]::Copy($payload, 0, $result, 0, $payload.Length)
    [System.Array]::Copy($sign, 0, $result, $payload.Length, $sign.Length)
    $result

}

# SIG # Begin signature block
# MIIcNwYJKoZIhvcNAQcCoIIcKDCCHCQCAQExDzANBglghkgBZQMEAgEFADB5Bgor
# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG
# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCBesLEAIS5VH1qj
# pdMTBySp3541wlH5X6xREsTolAlzoqCCCo0wggU2MIIEHqADAgECAhAM1s71mz4i
# 3j/UnuaI4vzeMA0GCSqGSIb3DQEBCwUAMHYxCzAJBgNVBAYTAlVTMRUwEwYDVQQK
# EwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xNTAzBgNV
# BAMTLERpZ2lDZXJ0IFNIQTIgSGlnaCBBc3N1cmFuY2UgQ29kZSBTaWduaW5nIENB
# MB4XDTE5MDQyMjAwMDAwMFoXDTIwMDQyOTEyMDAwMFowdTELMAkGA1UEBhMCVVMx
# EzARBgNVBAgTCkNhbGlmb3JuaWExEjAQBgNVBAcTCVBhbG8gQWx0bzEQMA4GA1UE
# ChMHSFAgSW5jLjEZMBcGA1UECxMQSFAgQ3liZXJzZWN1cml0eTEQMA4GA1UEAxMH
# SFAgSW5jLjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANEwuTFpw7fQ
# 3Ds5fvexal46Gg9TNMvdiJu7qMqDZnDJNl7ECdEPyLxsioGS7/yomOS9RXdXMJOm
# tyV4/wIPbBaGC8E2tbLTbQQ4IJbgvC+Vc46vbo+sI8YTG6qBICOovFw9VhUNXXEy
# SwHMoBNk8JS8R1slPpJKmNGB10HSatMGaHja0Lbqos0QuEx/tx2OXe+mzepIo66T
# dtSv2MfPy2tcVcXIdiJGn7f4otxoj6T9X7hVIl78r5Y2XWHYtDK8KaV1E/qkiNXK
# 1Xw5S53zv2VsZl6i1LZwt3d1Q9pUmm1AZe2YdhSGvwMP2LYBJGXIBbyLYnxS4HKB
# R7MYZyz7H2kCAwEAAaOCAb8wggG7MB8GA1UdIwQYMBaAFGedDyAJDMyKOuWCRnJi
# /PHMkOVAMB0GA1UdDgQWBBSnSAWgK15kcBLxsg4XNsT7ncH29zAOBgNVHQ8BAf8E
# BAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwMwbQYDVR0fBGYwZDAwoC6gLIYqaHR0
# cDovL2NybDMuZGlnaWNlcnQuY29tL3NoYTItaGEtY3MtZzEuY3JsMDCgLqAshipo
# dHRwOi8vY3JsNC5kaWdpY2VydC5jb20vc2hhMi1oYS1jcy1nMS5jcmwwTAYDVR0g
# BEUwQzA3BglghkgBhv1sAwswKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGln
# aWNlcnQuY29tL0NQUzAIBgZngQwBBAEwgYgGCCsGAQUFBwEBBHwwejAkBggrBgEF
# BQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMFIGCCsGAQUFBzAChkZodHRw
# Oi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRTSEEySGlnaEFzc3VyYW5j
# ZUNvZGVTaWduaW5nQ0EuY3J0MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQAD
# ggEBAJQblkFw+UYKYSY2M/CIEpJxZDnf+cDhodKAy+goI3XfExRHhyLu3Gc2ibFB
# Y4wyz/sJSfHehtNPYckXxR9k/FB/GfYtEACug9xXxJ+iLxWUNQ4KPt3bXY/kmDxW
# D1QXJFLbW5Dop3w/K0DL3fxnjOfYCcxsYodbeEiCJprCdNi3zd6x/J8Y35GDbLA5
# p7RfIAzKrmBLPHFGDWr/jWTfwPfUNz6jYJ51m0Ba9j81kzpxNUD0yBIZXBkVvSkx
# A09KxzMSSvxvV9DSqSezQBVgWnl9TbElouYUQwk64i0GzL4lTsphK4rQJJ2uuKtH
# wN4E0ibpm0uIqbLhgk+3ic8fHTIwggVPMIIEN6ADAgECAhALfhCQPDhJD/ovZ5qH
# oae5MA0GCSqGSIb3DQEBCwUAMGwxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdp
# Q2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xKzApBgNVBAMTIkRp
# Z2lDZXJ0IEhpZ2ggQXNzdXJhbmNlIEVWIFJvb3QgQ0EwHhcNMTMxMDIyMTIwMDAw
# WhcNMjgxMDIyMTIwMDAwWjB2MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNl
# cnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMTUwMwYDVQQDEyxEaWdp
# Q2VydCBTSEEyIEhpZ2ggQXNzdXJhbmNlIENvZGUgU2lnbmluZyBDQTCCASIwDQYJ
# KoZIhvcNAQEBBQADggEPADCCAQoCggEBALRKXn0HD0HexPV2Fja9cf/PP09zS5zR
# Df5Ky1dYXoUW3QIVVJnwjzwvTQJ4EGjI2DVLP8H3Z86YHK4zuS0dpApUk8SFot81
# sfXxPKezNPtdSMlGyWJEvEiZ6yhJU8M9j8AO3jWY6WJR3z1rQGHuBEHaz6dcVpbR
# +Uy3RISHmGnlgrkT5lW/yJJwkgoxb3+LMqvPa1qfYsQ+7r7tWaRTfwvxUoiKewpn
# JMuQzezSTTRMsOG1n5zG9m8szebKU3QBn2c13jhJLc7tOUSCGXlOGrK1+7t48Elm
# p8/6XJZ1kosactn/UJJTzD7CQzIJGoYTaTz7gTIzMmR1cygmHQgwOwcCAwEAAaOC
# AeEwggHdMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgGGMBMGA1Ud
# JQQMMAoGCCsGAQUFBwMDMH8GCCsGAQUFBwEBBHMwcTAkBggrBgEFBQcwAYYYaHR0
# cDovL29jc3AuZGlnaWNlcnQuY29tMEkGCCsGAQUFBzAChj1odHRwOi8vY2FjZXJ0
# cy5kaWdpY2VydC5jb20vRGlnaUNlcnRIaWdoQXNzdXJhbmNlRVZSb290Q0EuY3J0
# MIGPBgNVHR8EgYcwgYQwQKA+oDyGOmh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9E
# aWdpQ2VydEhpZ2hBc3N1cmFuY2VFVlJvb3RDQS5jcmwwQKA+oDyGOmh0dHA6Ly9j
# cmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEhpZ2hBc3N1cmFuY2VFVlJvb3RDQS5j
# cmwwTwYDVR0gBEgwRjA4BgpghkgBhv1sAAIEMCowKAYIKwYBBQUHAgEWHGh0dHBz
# Oi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwCgYIYIZIAYb9bAMwHQYDVR0OBBYEFGed
# DyAJDMyKOuWCRnJi/PHMkOVAMB8GA1UdIwQYMBaAFLE+w2kD+L9HAdSYJhoIAu9j
# ZCvDMA0GCSqGSIb3DQEBCwUAA4IBAQBqDv9+E3wGpUvALoz5U2QJ4rpYkTBQ7Myf
# 4dOoL0hGNhgp0HgoX5hWQA8eur2xO4dc3FvYIA3tGhZN1REkIUvxJ2mQE+sRoQHa
# /bVOeVl1vTgqasP2jkEriqKL1yxRUdmcoMjjTrpsqEfSTtFoH4wCVzuzKWqOaiAq
# ufIAYmS6yOkA+cyk1LqaNdivLGVsFnxYId5KMND66yRdBsmdFretSkXTJeIM8ECq
# XE2sfs0Ggrl2RmkI2DK2gv7jqVg0QxuOZ2eXP2gxFjY4lT6H98fDr516dxnZ3pO1
# /W4r/JT5PbdMEjUsML7ojZ4FcJpIE/SM1ucerDjnqPOtDLd67GftMYIRADCCEPwC
# AQEwgYowdjELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcG
# A1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTE1MDMGA1UEAxMsRGlnaUNlcnQgU0hBMiBI
# aWdoIEFzc3VyYW5jZSBDb2RlIFNpZ25pbmcgQ0ECEAzWzvWbPiLeP9Se5oji/N4w
# DQYJYIZIAWUDBAIBBQCgfDAQBgorBgEEAYI3AgEMMQIwADAZBgkqhkiG9w0BCQMx
# DAYKKwYBBAGCNwIBBDAcBgorBgEEAYI3AgELMQ4wDAYKKwYBBAGCNwIBFTAvBgkq
# hkiG9w0BCQQxIgQgbOjCbbltNClwa0hmPPzcKplHDLIqHbmdx3oAzvqX6JcwDQYJ
# KoZIhvcNAQEBBQAEggEAs3aOYKkpYUIDg8Yi4m/NxNmUtaWXpkydysFgAXCNNagj
# hUmZvp6xpy+ubvZR1dou5ACDN+WderCwH4BTDjqLDax015xDfYHMUVniO8DocJwH
# 5IYbSi1XTGb/ePWTU52Z0holVBDm5pMYPzZqDXgxKuHJNN1gpn4JPXow6EsaxvnO
# fnHJ28l+8Lybe2c7zBhp8qQexaTv85TX6dODuh0Njp3s4izkNWzFtgrSA+OH4ss6
# hFIp/WlB37x50+ERGuxYa8t5SgfRxU7/THzF+6opzkLBUOvbqNNB/+XU1ejBlV58
# VYIVCMr0LM6AndMD/PIPoAHfLdWy380ViHaW0nk4zaGCDsgwgg7EBgorBgEEAYI3
# AwMBMYIOtDCCDrAGCSqGSIb3DQEHAqCCDqEwgg6dAgEDMQ8wDQYJYIZIAWUDBAIB
# BQAwdwYLKoZIhvcNAQkQAQSgaARmMGQCAQEGCWCGSAGG/WwHATAxMA0GCWCGSAFl
# AwQCAQUABCCxBfIAhCTSWeFCtqIZWcGR5UglHRf+ZX88iEv6pT7WcAIQeLVWILvD
# 1ym2KM4BhuGYXxgPMjAyMDAyMTQyMjU3MDRaoIILuzCCBoIwggVqoAMCAQICEATN
# P4VornbGG7D+cWDMp20wDQYJKoZIhvcNAQELBQAwcjELMAkGA1UEBhMCVVMxFTAT
# BgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEx
# MC8GA1UEAxMoRGlnaUNlcnQgU0hBMiBBc3N1cmVkIElEIFRpbWVzdGFtcGluZyBD
# QTAeFw0xOTEwMDEwMDAwMDBaFw0zMDEwMTcwMDAwMDBaMEwxCzAJBgNVBAYTAlVT
# MRcwFQYDVQQKEw5EaWdpQ2VydCwgSW5jLjEkMCIGA1UEAxMbVElNRVNUQU1QLVNI
# QTI1Ni0yMDE5LTEwLTE1MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
# 6WQ1nPqpmGVkG+QX3LgpNsxnCViFTTDgyf/lOzwRKFCvBzHiXQkYwvaJjGkIBCPg
# dy2dFeW46KFqjv/UrtJ6Fu/4QbUdOXXBzy+nrEV+lG2sAwGZPGI+fnr9RZcxtPq3
# 2UI+p1Wb31pPWAKoMmkiE76Lgi3GmKtrm7TJ8mURDHQNsvAIlnTE6LJIoqEUpfj6
# 4YlwRDuN7/uk9MO5vRQs6wwoJyWAqxBLFhJgC2kijE7NxtWyZVkh4HwsEo1wDo+K
# yuDT17M5d1DQQiwues6cZ3o4d1RA/0+VBCDU68jOhxQI/h2A3dDnK3jqvx9wxu5C
# FlM2RZtTGUlinXoCm5UUowIDAQABo4IDODCCAzQwDgYDVR0PAQH/BAQDAgeAMAwG
# A1UdEwEB/wQCMAAwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwgwggG/BgNVHSAEggG2
# MIIBsjCCAaEGCWCGSAGG/WwHATCCAZIwKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3
# LmRpZ2ljZXJ0LmNvbS9DUFMwggFkBggrBgEFBQcCAjCCAVYeggFSAEEAbgB5ACAA
# dQBzAGUAIABvAGYAIAB0AGgAaQBzACAAQwBlAHIAdABpAGYAaQBjAGEAdABlACAA
# YwBvAG4AcwB0AGkAdAB1AHQAZQBzACAAYQBjAGMAZQBwAHQAYQBuAGMAZQAgAG8A
# ZgAgAHQAaABlACAARABpAGcAaQBDAGUAcgB0ACAAQwBQAC8AQwBQAFMAIABhAG4A
# ZAAgAHQAaABlACAAUgBlAGwAeQBpAG4AZwAgAFAAYQByAHQAeQAgAEEAZwByAGUA
# ZQBtAGUAbgB0ACAAdwBoAGkAYwBoACAAbABpAG0AaQB0ACAAbABpAGEAYgBpAGwA
# aQB0AHkAIABhAG4AZAAgAGEAcgBlACAAaQBuAGMAbwByAHAAbwByAGEAdABlAGQA
# IABoAGUAcgBlAGkAbgAgAGIAeQAgAHIAZQBmAGUAcgBlAG4AYwBlAC4wCwYJYIZI
# AYb9bAMVMB8GA1UdIwQYMBaAFPS24SAd/imu0uRhpbKiJbLIFzVuMB0GA1UdDgQW
# BBRWUw/BxgenTdfYbldygFBM5OyewTBxBgNVHR8EajBoMDKgMKAuhixodHRwOi8v
# Y3JsMy5kaWdpY2VydC5jb20vc2hhMi1hc3N1cmVkLXRzLmNybDAyoDCgLoYsaHR0
# cDovL2NybDQuZGlnaWNlcnQuY29tL3NoYTItYXNzdXJlZC10cy5jcmwwgYUGCCsG
# AQUFBwEBBHkwdzAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29t
# ME8GCCsGAQUFBzAChkNodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNl
# cnRTSEEyQXNzdXJlZElEVGltZXN0YW1waW5nQ0EuY3J0MA0GCSqGSIb3DQEBCwUA
# A4IBAQAug6FEBUoE47kyUvrZgfAau/gJjSO5PdiSoeZGHEovbno8Y243F6Mav1gj
# skOclINOOQmwLOjH4eLM7ct5a87eIwFH7ZVUgeCAexKxrwKGqTpzav74n8GN0SGM
# 5CmCw4oLYAACnR9HxJ+0CmhTf1oQpvgi5vhTkjFf2IKDLW0TQq6DwRBOpCT0R5ze
# DyJyd1x/T+k5mCtXkkTX726T2UPHBDNjUTdWnkcEEcOjWFQh2OKOVtdJP1f8Cp8j
# Xnv0lI3dnRq733oqptJFplUMj/ZMivKWz4lG3DGykZCjXzMwYFX1/GswrKHt5EdO
# M55naii1TcLtW5eC+MupCGxTCbT3MIIFMTCCBBmgAwIBAgIQCqEl1tYyG35B5AXa
# NpfCFTANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGln
# aUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtE
# aWdpQ2VydCBBc3N1cmVkIElEIFJvb3QgQ0EwHhcNMTYwMTA3MTIwMDAwWhcNMzEw
# MTA3MTIwMDAwWjByMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5j
# MRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMTEwLwYDVQQDEyhEaWdpQ2VydCBT
# SEEyIEFzc3VyZWQgSUQgVGltZXN0YW1waW5nIENBMIIBIjANBgkqhkiG9w0BAQEF
# AAOCAQ8AMIIBCgKCAQEAvdAy7kvNj3/dqbqCmcU5VChXtiNKxA4HRTNREH3Q+X1N
# aH7ntqD0jbOI5Je/YyGQmL8TvFfTw+F+CNZqFAA49y4eO+7MpvYyWf5fZT/gm+vj
# RkcGGlV+Cyd+wKL1oODeIj8O/36V+/OjuiI+GKwR5PCZA207hXwJ0+5dyJoLVOOo
# CXFr4M8iEA91z3FyTgqt30A6XLdR4aF5FMZNJCMwXbzsPGBqrC8HzP3w6kfZiFBe
# /WZuVmEnKYmEUeaC50ZQ/ZQqLKfkdT66mA+Ef58xFNat1fJky3seBdCEGXIX8RcG
# 7z3N1k3vBkL9olMqT4UdxB08r8/arBD13ays6Vb/kwIDAQABo4IBzjCCAcowHQYD
# VR0OBBYEFPS24SAd/imu0uRhpbKiJbLIFzVuMB8GA1UdIwQYMBaAFEXroq/0ksuC
# MS1Ri6enIZ3zbcgPMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgGG
# MBMGA1UdJQQMMAoGCCsGAQUFBwMIMHkGCCsGAQUFBwEBBG0wazAkBggrBgEFBQcw
# AYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEMGCCsGAQUFBzAChjdodHRwOi8v
# Y2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURSb290Q0EuY3J0
# MIGBBgNVHR8EejB4MDqgOKA2hjRodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vRGln
# aUNlcnRBc3N1cmVkSURSb290Q0EuY3JsMDqgOKA2hjRodHRwOi8vY3JsMy5kaWdp
# Y2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURSb290Q0EuY3JsMFAGA1UdIARJMEcw
# OAYKYIZIAYb9bAACBDAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2Vy
# dC5jb20vQ1BTMAsGCWCGSAGG/WwHATANBgkqhkiG9w0BAQsFAAOCAQEAcZUS6VGH
# VmnN793afKpjerN4zwY3QITvS4S/ys8DAv3Fp8MOIEIsr3fzKx8MIVoqtwU0HWqu
# mfgnoma/Capg33akOpMP+LLR2HwZYuhegiUexLoceywh4tZbLBQ1QwRostt1AuBy
# x5jWPGTlH0gQGF+JOGFNYkYkh2OMkVIsrymJ5Xgf1gsUpYDXEkdws3XVk4WTfraS
# Z/tTYYmo9WuWwPRYaQ18yAGxuSh1t5ljhSKMYcp5lH5Z/IwP42+1ASa2bKXuh1Eh
# 5Fhgm7oMLSttosR+u8QlK0cCCHxJrhO24XxCQijGGFbPQTS2Zl22dHv1VjMiLyI2
# skuiSpXY9aaOUjGCAk0wggJJAgEBMIGGMHIxCzAJBgNVBAYTAlVTMRUwEwYDVQQK
# EwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xMTAvBgNV
# BAMTKERpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJRCBUaW1lc3RhbXBpbmcgQ0ECEATN
# P4VornbGG7D+cWDMp20wDQYJYIZIAWUDBAIBBQCggZgwGgYJKoZIhvcNAQkDMQ0G
# CyqGSIb3DQEJEAEEMBwGCSqGSIb3DQEJBTEPFw0yMDAyMTQyMjU3MDRaMCsGCyqG
# SIb3DQEJEAIMMRwwGjAYMBYEFAMlvVBe2pYwLcIvT6AeTCi+KDTFMC8GCSqGSIb3
# DQEJBDEiBCA07HjPc8HxPLuDS/we7XLmgKtO7IT2C0qkKexNArKQHDANBgkqhkiG
# 9w0BAQEFAASCAQBrKGjvccwPoLNKR9dMi7DGwKK0Zbh+/IRuozRA+GNt0WbAENT7
# Njl1NoygkHo33uUc+Xzc4z5nz5yxoxZUiehd7C8qofY3wLisQX5IckUVjHmWK45f
# OWuu/DxTjtKjSKzhVsww1Lywyo46iqsgh4JxuNwTeDwaCgCh5HPOYeVxB57MwyO3
# CbXR98W86BMm0ZFSIl68xp4AbeRxXUr/iutd5ZDOOHmzFlfGLnOb549EPwcI2xf9
# +xIUXx12BdF/T+M93WrS15ukYe22K3dL+nHpAAa4EszuKE/+DSHPkfu8arHjfgFY
# 5W2gXpZgUpTSvpMPTdox2T/mE6PnZwQk/Qm5
# SIG # End signature block